|  | 6.4 | Extended ACLs
| 6.4.4 | Writing an ACL for denying FTP on an Ethernet interface

Figure shows an example of an extended ACL that blocks FTP traffic. The interface E0 access-group 101 command links ACL 101 to outgoing interface E0. Note that blocking port 21 prevents FTP commands from being transmitted, thus preventing FTP file transfers. Blocking port 20 prevents the traffic itself from being transmitted, but does not block FTP commands. FTP servers can easily be configured to work on different ports. You should understand that well-known port numbers are just that: well-known. There are no guarantees that services will be on those ports, although they usually are.